From 4205fdc411701ffc323769d41508e0875b9d63d4 Mon Sep 17 00:00:00 2001 From: Jonas Witschel Date: Sat, 21 Nov 2020 12:11:45 +0100 Subject: cifs.upcall: update the cap bounding set only when CAP_SETPCAP is given libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error of -4 when trying to update the capability bounding set without having the CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng silently skipped updating the bounding set and only updated the normal CAPNG_SELECT_CAPS capabilities instead. Check beforehand whether we have CAP_SETPCAP, in which case we can use CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set. Otherwise, we can at least update the normal capabilities, but refrain from trying to update the bounding set to avoid getting an error. Signed-off-by: Jonas Witschel --- cifs.upcall.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cifs.upcall.c b/cifs.upcall.c index 1559434..af1a0b0 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -88,6 +88,8 @@ typedef enum _sectype { static int trim_capabilities(bool need_environ) { + capng_select_t set = CAPNG_SELECT_CAPS; + capng_clear(CAPNG_SELECT_BOTH); /* SETUID and SETGID to change uid, gid, and grouplist */ @@ -105,7 +107,10 @@ trim_capabilities(bool need_environ) return 1; } - if (capng_apply(CAPNG_SELECT_BOTH)) { + if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) { + set = CAPNG_SELECT_BOTH; + } + if (capng_apply(set)) { syslog(LOG_ERR, "%s: Unable to apply capability set: %m\n", __func__); return 1; } -- cgit v1.2.3